The fact that GDB can attach to any process without having su rights is terrifying to me. For example, what prevents me from writing a malware/virus(/whatever the correct term is) that uses same system calls with GDB to attach to any processes, send interrupts, change instructions on the fly, add breakpoints to branching instructions to alter ZF etc.?
You can clearly do lots of harmful things with this ability. For example, I'm doing some minor hacks using some GDB Python scripts and I can't see what's preventing me from writing some seriously dangerous/malicious stuff.
So I have some number of questions related with how is this possible and how is this safe:
(I'm assuming that it's the operating system who allows a process to somehow send interrupts to some other one, and access to it's address space and alter the memory. Please correct me if I'm wrong)
1) What makes this safe? What prevents me from writing a program that alters behaviours of every single process running in a system?
2) What system calls are involved? How does operating system give me access to address space of some other process, while not taking my own address space from me. (e.g. GDB has it's own address space, but it can also read attached process' address space)
3) In my user-level program, is it possible to detect this kind of "attaching"? Like, can I print a message and terminate if another process is attached to my program? How do I detect this?
(I'm using "attaching" as "starting writing/reading my address space")